Skip to content

Zapier Webhook

Service Name: Zapier

Service Description: Zapier is an online automation tool that connects your apps and services. It allows you to create automated workflows (called Zaps) between your favorite apps, so they work together.

Service Address: https://zapier.com/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants the ability to trigger Zapier workflows via HTTP requests to the webhook URL.

Secret Revokement URL: https://zapier.com/app/dashboard (Navigate to the specific Zap and delete or disable the webhook trigger)

Secret Example: https://hooks.zapier.com/hooks/catch/123456/abcdef/

Suspicious Activity Investigation Instructions:

  • Check Zapier dashboard for unusual activity or unrecognized Zaps
  • Review the webhook trigger history to identify unauthorized triggers
  • Check if the webhook has been triggered from unexpected IP addresses
  • Review any data that has been sent to the webhook

Mitigation Instructions:

  • Log in to your Zapier account
  • Navigate to the Zap containing the exposed webhook
  • Either disable the Zap or delete the webhook trigger
  • Create a new webhook trigger with a new URL
  • Update any legitimate services to use the new webhook URL
  • Consider adding authentication to your webhook if possible